The war between Russia and Ukraine has been ongoing for almost 4 years now. Western sanctions were intended to isolate Russia economically. Instead, they forced Russia to adapt.
In 2025, BeInCrypto began documenting how Russia and individuals with connections to Russia were establishing new payment pathways with cryptocurrency. It was not about a single exchange or token, but about a robust system that could withstand freezes, seizures, and delays from authorities.
This review describes the system in chronological order, based on analyses of blockchain data and interviews with those investigating the money flows.
The first warning signs were not criminal
Early signs did not indicate ransomware or darknet markets. Instead, they pointed to trading.
Authorities began asking new questions about how money crossed borders during imports, how payment for dual-use goods occurred, and how transactions were made without banks.
At the same time, blockchain data showed that Russian OTC desks increased significantly. Exchanges with Russian OTC liquidity also received higher volumes, especially in Asia.
Telegram groups and darknet forums openly discussed how to circumvent sanctions. There were no hidden conversations. They described practical ways to transfer value across borders without banks.
The method was simple. OTC desks received rubles in Russia, sometimes in cash. They then issued stablecoins or crypto. The crypto was sent abroad, where it could be exchanged for local currency.
Garantex operated Russia's hub for crypto laundering
Garantex played a vital role in this system. They acted as a liquidity center for OTC desks, migrants, and payments related to trade.
Even after the initial sanctions, Garantex continued to collaborate with regulated exchanges abroad. That activity persisted for several months.
When the authorities tightened supervision, many believed the system would be disrupted. But what came was preparation.
“Even individuals leaving Russia still used Garantex to move their money. If you wanted to relocate to cities like Dubai, this became one of the most crucial ways to transfer money when banks no longer functioned. For many Russians wanting to leave the country, Garantex became a practical way out. It was one of the few ways to send money abroad after banks and SWIFT were no longer available,” said Lex Fisun, CEO of Global Ledger.
The seizure led to a reserve hunt
When authorities took over Garantex's infrastructure in March 2025, a linked Ethereum wallet quickly accumulated more than 3,200 ETH. Within hours, the wallet took almost the entire holding to Tornado Cash.
It was crucial. Tornado Cash does not distribute money, but breaks the traceability of transactions.
A few days later, dormant Bitcoin reserves began to move. Wallets that had not been touched since 2022 accumulated BTC. There was no panic selling, but an attempt to keep track of assets under pressure.
It became clear that assets outside the stablecoin sector were still accessible.
A successor emerged almost immediately
As access to Garantex diminished, a new service emerged.
Grinex started discreetly and began supporting USDT. Tracked transactions went through TRON and connected to Grinex infrastructure. Users saw their balances reappear under the new name.
“That was probably the most obvious name change we have seen. The name was almost the same, the website looked the same and users who lost access to Garantex got their balances back on Grinex,” Fisun told BeInCrypto.
At the end of July 2025, Garantex officially announced payouts to former users in Bitcoin and Ethereum. Blockchain data showed that the system was already in use.
At least 25 million USD in crypto had been paid out. Much more remained untouched.
The payouts followed a clear pattern. Reserve funds were sent through mixers, aggregation wallets, and cross-chain bridges before reaching users.
Ethereum payouts used deliberate obfuscation. Funds were sent via Tornado Cash, then to a DeFi protocol, and subsequently across multiple chains. Transfers switched between Ethereum, Optimism, and Arbitrum before payout wallets received the money.
Despite this complexity, only a small portion of the ETH reserves reached users. More than 88% remained untouched, indicating that the payouts were still in an early stage.
Bitcoin payouts showed another weakness
Bitcoin payouts were simpler and more centralized.
Investigators identified several payout wallets that connected to an aggregation hub. The hub received almost 200 BTC. The hub remained active for several months after the seizure.
The most revealing was what happened to the money afterward.
Source wallets often interacted with deposit addresses linked to one of the world's largest centralized exchanges. The transaction exchange was always sent back there.
Therefore, Western sanctions have struggled to keep up
Western sanctions were not lacking. They came late, unevenly, and slowly.
When Garantex was finally halted, investigators had already documented that billions of USD had passed through its wallets.
Even after sanctions were imposed, the exchange continued to collaborate with regulated platforms abroad. They exploited delays between decisions, supervision, and updated regulations.
The problem was not a lack of legal authority. The main issue was that sanction efforts moved slower than crypto infrastructure. Authorities need weeks or months, but crypto systems redirect money in a few hours.
“Sanctions work in theory. The problem is enforcement. Billions can still be moved because supervision is slow, fragmented, and lags behind the pace of crypto. The problem is not that sanctions are lacking. It is that they are enforced too slowly in a system that moves at crypto speed,” said the CEO of Global Ledger.
This gap allowed Garantex to adapt. They frequently changed wallets. New hot wallets appeared unexpectedly. Remaining funds were moved to make it look like normal exchange activity, which made automatic systems less effective at detecting anomalies.
Private companies had difficulty keeping pace. Banks and exchanges must weigh compliance demands against transaction speed, customer convenience, and costs.
In that environment, sanctioned transactions could go through if the activity did not raise clear warning signs.
In October 2025, the payout system was still active. Reserves remained. Several pathways were still open.
This was not a market collapse, but rather an evolution of a system.
Russia's crypto strategy 2025 shows how an economy under sanctions can adapt by building parallel pathways, preserving liquidity, and finding workarounds when blockages occur.
